stealc | 4e0cc5408f12dcd82ac104d09759545cf2f0c58277bf8cae1bf196ddbfa75060

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
Size 3.1MB
Sample260929-z2askafe42
SHA256 4e0cc5408f12dcd82ac104d09759545cf2f0c58277bf8cae1bf196ddbfa75060
MD5 843ca27f0a690cd9fdf34c05b4347681
SHA1 270201f20d6d061322c426357b4346a4720eb09b
SHA512 70070b41d752ad962b444166754689dce3c9862e53b22c41ae4aa8ce64a26039488f89b7c46f9ae6c0cbaf0d327fd8973d4cdc49f5ff4249c4085965fe653504
SSDEEP 49152:h5qMJhxSMmT8oWgBCaXJarSj8RoTCCQhxSMmT8oWgBCaX:h5qG+M4FHXJJTU+M4FHX
TLSH
T1C9E512107BC1C036E47325358E7EC72959AD7DB46B1282CFA7C02B6E6E70AD1A931B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/2984-263-0x0000000000400000-0x000000000071B000-memory.dmp	family_stealc_v3

Executes dropped EXE 12 IoCs

pid	Process
3740	elevation_service.exe
904	elevation_service.exe
5032	maintenanceservice.exe
5392	OSE.EXE
5076	PerceptionSimulationService.exe
4964	perfhost.exe
3564	ReFsDedupSvc.exe
5708	SensorDataService.exe
6112	ssh-agent.exe
2020	AgentService.exe
1228	SearchIndexer.exe
5396	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
	\??\F:\	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\162b9a257465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009337-252.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf28fa725750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf483735750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7eebdb15750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009024da705750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b188e725750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2699bb15750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
904	elevation_service.exe
904	elevation_service.exe
904	elevation_service.exe
904	elevation_service.exe
904	elevation_service.exe
904	elevation_service.exe
904	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeBackupPrivilege	3564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3564	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2020	AgentService.exe
Token: 33	1228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeDebugPrivilege	3740	elevation_service.exe
Token: SeDebugPrivilege	904	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
200	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 5200	1228	SearchIndexer.exe	101
PID 2984 wrote to memory of 200	2984	2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe	102
PID 1228 wrote to memory of 5128	1228	SearchIndexer.exe	105
PID 1228 wrote to memory of 5376	1228	SearchIndexer.exe	107
PID 1228 wrote to memory of 5844	1228	SearchIndexer.exe	108
PID 200 wrote to memory of 5396	200	AdobeARM.exe	112
PID 1228 wrote to memory of 3516	1228	SearchIndexer.exe	113
PID 1228 wrote to memory of 2176	1228	SearchIndexer.exe	114
PID 1228 wrote to memory of 4772	1228	SearchIndexer.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_843ca27f0a690cd9fdf34c05b4347681_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5032

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 af1ffe1e987c23c7ebf5f3927f32a2ae46a551c5b7fe0f228efafc6c1962883b
MD5 9004ae05529b8e1d545e49afa5ae8777
SHA1 816ed3ad32e4b50a61ff2933cf08421e4ed800c3
SHA512 492d207ca6647a5c4a84bb3633047a9c3b2f79dd0d46f41e9ea47ebd6f7b33e74aa203b3e60f67f3e993d088dc93eaedc0326cd3daaf66f4d68b2e4521ea4a1d
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4hxSMmT8oWgBCaX:r3q6HjBh+M4FHX
TLSH
T1E2D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 2bddbce88718bd2fd20858c6c4e1c36c49f14ce9bf2920c922a4a29d799ad9b8
MD5 ccd9aa3fa54bae1a06e6eee32173c968
SHA1 e886da70c895a22217c5e137647ef658715e5228
SHA512 e8aeb1efd1fb09ba4c74c1cc54c49fcbf21ae0140853a18830d489b84cc1d07f35339ce646af5e1eddd19287be4093b3ac2924b9206a5239faf8d74e927c2019
SSDEEP 24576:lXYfDtczACrKhxr+EHNmT8oW4ll1JCrLKXI:wtcuhxSMmT8oWgBCaX
TLSH
T1B985012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8ba884d8b314327d1ceb8d79ffecd891afe04b5f767080ce520869e2b12f8271
MD5 aa8cdd2e4636b3b9418f837d334c3ab3
SHA1 a9308fe3faf60cee2fd9000e0a6bcec5b15ab26a
SHA512 5ab00c96ae09abf8029b8498b447845db2debee60684e767017de462dae6daf97f68afbe584e325a31f4120959e38ed3ca56ab3658f92cf0e4721a3742a6a45c
SSDEEP 24576:40Le5ji0hmxYrMJrKhxr+EHNmT8oW4ll1JCrLKXI:4Pji0A23hxSMmT8oWgBCaX
TLSH
T1DD95AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d3043e0c91fa7bd4c6e00e851110310dfa981ed015982140ac8ef0860f6fb54
MD5 f5c35e0717a24dd44250eb34774a99c7
SHA1 3d0a3444c1d667edd8954ec0239ba87b909611d0
SHA512 35a2671a3138c8b675324f661302a252ae626dece825b95f90c6179436a1a073d09e742d3a2006a2697e3970209683c784f39cdcf83d480d2f3a7bb4d9b185b2
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyufrKhxr+EHNmT8oW4ll1JCrLKXI:c/ezSC6vUzPvxHjyLhxSMmT8oWgBCaX
TLSH
T185756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 78d7ee5d54eb396afd6a1337f40c866b0f77d19f38b8a98c49dd3c9d2373bb51
MD5 1df2439c2955a54fabf2120e0e19dd38
SHA1 20e7d4cac6c32f5543679649df0e0db069f9a05b
SHA512 e16b41b9f0f0ca8f62b3ec8302a81070e7ac8a93125010cec4b2b3080e166196cf0b0b941955375759354f5bce643d2b2edf2e9e4622938523781fdd5bb2a029
SSDEEP 24576:MVbqPb88hv/l+6urKhxr+EHNmT8oW4ll1JCrLKXI:MVO88hXl+EhxSMmT8oWgBCaX
TLSH
T1D5559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 963773265c1b38cfbff1e901ff4777bdf25e60b21b3a3b6e00a74cebb1bad992
MD5 5b24212631f44409de2c375c4470e5f8
SHA1 b2d437e8169922f8a0cefe87602efb2e0725906d
SHA512 52780afe37597b35cb905f47b34ef795cdd83df4db4b930a4f5adbab9441bd3e032a830927409dfad634df0c41d7070a688000c44ffe61d57100f364ef524198
SSDEEP 12288:4HDJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:4HFrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F46523759F0D64ABEE3B8335F872571299990DDCE1412E3B9F3A3FAC3934C1A9052212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f0bc73447613c2a05f9228de4fb75d7f1c88a25e1f4929cef31f423d94392224
MD5 37aa48bb9802bbc1dbb1a45e8408d94e
SHA1 d5f91ed4d4b29ba232bdd37f6081c0e23307b5e0
SHA512 16fef8d97e3e1621d44f54f060808b8e664fb51b4869cd5805b7dd618cc0ef8e2d10d6bcbd50804b10caecf392b8af5c1d8bff462b9e2c4d3d11b22e2cbdecb9
SSDEEP 12288:weBNUbTVO86UmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:wJIUGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10B85CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b3e82246bd5d61c6f22408251231749f1cf90e5622b03d2fc32223ab2460de86
MD5 4b4603407e1088c1c69204a60487e338
SHA1 ba0326206b4a2d52a4213b7603e1e48acdcc217e
SHA512 df4893e12a6b448a4a2e21b7b1ac30082010ce254a51319b891ba48bc312dc3486243fbdb227e41d9272eb5984f7aea2ab8c35c6ac1198dd1f4205be52034168
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:7QvGAdlCEL8c/yRNw5CO+M4FHX
TLSH
T181266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1dad7427a3ce109f32f90082b3322c90e697e20449b86f1e6f8c9cc7b52d0c27
MD5 a4d434629f6b56da888c78f3bf984c38
SHA1 e5a8b6aedb8ca892c452a29d7098868aeec91b39
SHA512 36434f68136f6e65a11fe727ed47d29672c254f72012eb22dc842d2bed2b7dd00ac61b6d19cc5feca983e1d92234778a5529942e261262ca4809593105590c5e
SSDEEP 24576:B7ewsAjUrKhxr+EHNmT8oW4ll1JCrLKXI:ZljnhxSMmT8oWgBCaX
TLSH
T16E85E031FF74E036C67F0D766B36C716586C6A604B512AC3E3B88E9D59302D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bc2418b176277a270a019fed7bd6a64eb9eae4f82efb8249b7fe00f562afd217
MD5 e3f9761d21b4835daaae25244a4cd6ae
SHA1 d797bff67790b5136c4cfab433b17a831f4c9e7c
SHA512 51b9341e78b3d9a629697591f97a655bb077d5974309111bf9563ec259eb47b8ad059c50a46e06d228555c09a8f66377724a73a2ea6cacbb3493f1893cc96734
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHT4:WUEtQevvqc2W1cpV2EI32T4
TLSH
T1E9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b35f958e634141cb5acdb63175433056a2ec330f66a4d9522d24b9b25f0dedf3
MD5 f599cc781687e2333a0c8bd214819bb1
SHA1 1936e7743173edbd096656e8acf5616b06efbf54
SHA512 c555525a5eedd7985e7819a6d261127b3cb658b886df80f931caa47ab923ba224e94e0ecba09ad0acc99a97da309f88512238f0e45539b0c5725827a0e7e4931
SSDEEP 49152:ECbRquA/m2yL5zTfFiV+XenmE3/zHhxSMmT8oWgBCaX:NoquVjnmC+M4FHX
TLSH
T128D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c377dd7a9c96053f90a384182de9fa58c5601e8556ac73f06e00f04ef7c76114
MD5 e05c1c48db8e7031cebeb0b522da3279
SHA1 c3bc2b55f4bdf7771ff0135cf9bb2eaefcf231d6
SHA512 1414d7494999f0fe38db1e0eacfa0a2d6327de5e7fcca6344c2c80384065e8f4e7a31b10cf60a154d2d55c6be908586b56659b70248c2f73daed0ee82095cb4f
SSDEEP 24576:yAhGLJIFoiwtA5l7S53TrKhxr+EHNmT8oW4ll1JCrLKXI:yAMyFoiq5yhxSMmT8oWgBCaX
TLSH
T16E35AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3b1ba9f36af634af7996b1614403b58807d9865245cab642caa2983e54f0f349
MD5 124252a4542c5b8a8d3b18288a93f9c6
SHA1 5aec232a5efce5760a84fe51afed8f53e0b08d0b
SHA512 7f6921e2ca5435c00216d10055b92db32119f56cc1c6abf7bf7a5dbef26ce71a1294a47280f7c38a4f0e9a408326a3a725ad132746ef35b361a063533c965d4b
SSDEEP 24576:1wuSOWYrKhxr+EHNmT8oW4ll1JCrLKXI:1w9O2hxSMmT8oWgBCaX
TLSH
T17985F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b4f2f290dbca34eb0eac0dd6958b19263d621ae5a97c69083ee9e4c909cbf438
MD5 1d3dbf8057c2ed4d41b6c5fe3d100d1c
SHA1 6cac88cdf8a5e5bfe56164bced167ffbd2aff92b
SHA512 a64abc90c476b8f00d51873eb64be3015f0ade9b30d87d4f2e3cf9ecfc974f6256612d17aba6190ff071d37df4530d3379376ff7abc94eb04e85acdeb7276655
SSDEEP 12288:RjZ1IyoJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:tZuhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CB75126A379870FAE967823CDCE14605D7B23899633143DF1A3546A92F33EC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 959f48b5b21b5cec41e27fd94f47d40eb41d867d2ea534fb7ce2ad4142e3f2b1
MD5 16e4d78ed53568cc9db3879e0176721f
SHA1 989cba06127c2b1e85b1701c4c74699f6ad7fc20
SHA512 afaf3a23bfe509edcffe997516c5b826defd79ef6bb371dbd259c0fb24397dae752e00615d510c4ae331d7ea543f3122b17dfd40126eb9bb9050c817a836853f
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:3QRQyi36YOcPQLvw2gAf+PN3t+M4FHX
TLSH
T18A667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f285951868068193a853b7c4158a749c1b74e6758bde99fdb00258dbff2e1f8
MD5 4bf18960e60eea45a58dafa838f35e99
SHA1 94e8a71a51bad269570b6455aef0b09e59b124ed
SHA512 426ea6f57e741d99fdda7ef7ee08a28f17638eb2336757c1fad1f7e036b2bc1fd5e9e4491497167a67349b52bc68944ebcc796e6b6f28923343df35fe7f84c6f
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:pQRQyi36YOcPQLvw2gAf+PN3t+M4FHX
TLSH
T161667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 15b138be272b54efcc859e9bfc051155774a645f8acfe43124787c246747a6d2
MD5 57036007cdab9894c947b34c7733755b
SHA1 164b6961e2b02bd9f748dc42a775d19da9441136
SHA512 0cd9bb4f2804ddc3906e9b5d5dfa550474a06a2bd25debc8f1617b1ab3a047aa85f6ec69f77d7c73c27ccf27fe97f332c5aedeadee8dcc935f534f4b2389a63d
SSDEEP 49152:q68Qg55nhheWu7PNU3/3hxSMmT8oWgBCaX:YthWRc/3+M4FHX
TLSH
T1B0B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8549caffd64e2f10285be18943d38fdc8599db65629ab3414f4e365ccd9474a2
MD5 e25f10b88e23c42f62ee6b945cf99054
SHA1 fe22c4abdea29d03756985eb78846ad79b1d999a
SHA512 1d1d72512a2dff8125dcdbf72476e81a9dfb7afb61debc6e2c250efced9233d7d70dfa72a2aadcc6f3dde6679281b8ffcb932126a2db7bd8f0fddb69a0756a89
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:Vy5112gYy5azzVvL69nLKnhZM+M4FHX
TLSH
T117167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 993af301cb42c2fec1ea8f5065b79215769769ae5f0e00833e4e399b0fe43c58
MD5 e52dd0d98baf8270e854a0be7a316577
SHA1 b689af99e411b75708d99a203cd9a6073d3d994d
SHA512 4745fe1ce301864ce7c1c76615ea87cc8ea03dae3fef5286537dda4f78973132b664f8e968efd4046781a874ccc633f0bd44ce942619070e48c54d87c0df1dec
SSDEEP 49152:GB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFhxSMmT8oWgBCaX:0u6JmVxd2dF+M4FHX
TLSH
T10AD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bf4ea4d450c35e6a64e2a74ae99801ac5361801ce563f1e21009a0efca73908e
MD5 c3a62f47877c9f472b484f3d29de9c49
SHA1 5d49c3f820beda80cb6352342cd18956ad4ad1b6
SHA512 d121eeec4d1038a847a451d7fcca568853e9a3b88bd5a87709743f8118366bae1a0d6349ddd319a0294c95d3eebebb9b7a8b0b3e521d8dc8396a2d95405a1987
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xphxSMmT8oWgBCaX:emifPbRC+M4FHX
TLSH
T1D6B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c456b569ad310bf1a33155c38fba6d1cb89dbec38c0b6eb09f9c966582d808e0
MD5 8568578cca6b6b98e15fb493feea466e
SHA1 239ca87dfdbc9a606f3d2e1fb1e0868eae4c2af0
SHA512 9e54705729842f36ed7b7838b0221a8ad4acf55a4314185b5baf4018bff147c39ec87ccad5d07a74fb8fad6d8a8e65bb00fd820172f5367fc766edabeed36234
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqohxSMmT8oWgBCaX:U5dKTi61o+M4FHX
TLSH
T103C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5145d67bccc6eda92b90fdf72557c8b2e6e7029a2c17badf24d79f8f0ba723b6
MD5 e20a652770de826ea29eccedb0a591d5
SHA1 3ce65e9d3d4a213c8ad718a6a0bb6bca5ef4e413
SHA512 ed42c6704b72f69eeae47418884bf4317c45953dcb3b2e6231a77a6ed657d7de948e2b4feb50fff82b2ad10998eecacf47287efc1943a6a65d8d74175f95a375
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5w1hxSMmT8oWgBCaX:5X2iyphW+M4FHX
TLSH
T1ED95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 61ce690b1c9c7f24b24ab03281e10db084183b49f0fb95534471422a8011188f
MD5 9813831cfff12e520dcb5782090961da
SHA1 93932b2d7b99eddbaca62768e767cd863be32802
SHA512 99771a6d366783b2b22947487d59e5259c5d3e2289c12102b447e0f193ab7bc6872c048c2cf87a69204687b26615d2607558280041b96ebfb0f48e004f5bfe87
SSDEEP 12288:/7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F1652375AF0F94EBED2AC335E862071699DC0DDDF201163BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 39edfc729e69b2cd81cd2cce43fa33bc80ff9f12e15f8a553abb0e9dbcba0f3d
MD5 61382c91cf9d762f235e91dbe03c7f6c
SHA1 f3000ed8c81b1772e5cdf1c7668bff8eee41cb8e
SHA512 c21ff3157de86289e5a9e6f9a0a1a38d323b64930fe85f3fa53abc7e0d3bb87b7555ac8d38f35863b8835b9cccbcb6558956dc9ee0dc627afc81b62117641f25
SSDEEP 12288:mUJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mgrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B6652375AF0F54EBED2AC335E8624316D99C0DDDF202163BAF3E2E683B31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 224e84aa914c26c7b500fed89a7deff7a8c4d83087b3d9080e5e0fb8e4110959
MD5 80dcb197e7b0a2beb6d8ab670886f91c
SHA1 afa8a9c327710ded4931621d36ccc9889bc618b6
SHA512 f9008d87776cabe2d3bac1aaebf209d114b48528582d744769312f75f9d49b90c67b4a1deaca988898f3ec832feb088366ad8b5311fd808cc80f305142d6bd62
SSDEEP 12288:a+JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:aerKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T190652375AF0F949BED2AC335E8620716D9DC0DDDF201263BAF3E2E683A35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 8976da07addac8abd14a3038c07ebc61705bad5d8e315e4b3dbafaea9489f54d
MD5 92126890edf2f94d9af0df66fcf0f492
SHA1 592c27f5cb2f2fa4f1630e62a7cdf5daa34a956c
SHA512 3971eef11bf7a6a0ac8123f4a408ff9e2d1a7adcae296fd67a040318f93175935dea950b92e2e1983c5d28df13f21112db096a96944e908ef6fb15758bb8ded7
SSDEEP 12288:lVdJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:TrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1806523656B4E50DBEC27C338D8724211D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 dc85af71941f069b2ac2c1f8e6f70cae64bb2b1633ed3c34944cd3a23e284715
MD5 1eb418aa09a73da8074529337288955a
SHA1 d77dcebee1f00f5cbbcf7fe2bd1958106d16d779
SHA512 d839c87ab5d9c28bf2fb2d59b4b917e2564cceb9e1f486974e9bd1da286ac539007c1a5556fdabe0a57ff7c2f077749e7b85c36771b36ce5cd46566f335bbf48
SSDEEP 12288:mFJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mbrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T154652375AF0F949BED2AC335E8620316D9DC0DDDF242263BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 ca4504ae32271b003cd1e246c847417f00635f288c1629eb480032d62cf6af1a
MD5 1763b5d3f7e73e5f01889dd57bf8c03f
SHA1 c741fdb0ec4a5d6c296c098248d778570314248d
SHA512 cf72f8bb9835195429e50a468fbba9f39a826d9c99fb545e69a800a58986f7a9f363119abbc39d3cb29075fc2669c78bbc160e2bcaa7878ba7c2b3540fe6b705
SSDEEP 12288:DwJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:DsrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17E652375AF0F54EBED2AC335E8620716D99C0DDDF202163BAF3E2E683B31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 2f6114517b4df17f0b2cf07ce496bf47a5c02da42f6086873dc8f0e2a20d4e5c
MD5 d24037b0e14497cbc0d9aa7349abb4b9
SHA1 55acb05c174f4f17fd67e7421022742d377b1c3a
SHA512 95994da86543f4a59e6d34050afd1fa98d7902feb4d2331099bf51ba3ec4e3d9838278727907788b5dfbf250ecae79edec4ee156c08b5ee5d32993da327e45b3
SSDEEP 12288:UcJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:UIrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12C652375AF0F94ABED2AC335E8624715999C0DDDF202163BAF3E2E683B35C1A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 edd87fe23128154b67d1bc0d06baaec062a025e1c1c1aaa7a597871b330f13fe
MD5 880ecac78fbb70717bdee476ae4c3362
SHA1 9dede958ea99585a11d2396cb98fc1162a155d0d
SHA512 c976c116b7339c5940cbfbf015aea9b55683adbaf6b1f3511e52aa3827ad44874237f742ea3577f068b077d332285dd4eee1288e121fbe44e969c163daba29e6
SSDEEP 24576:8ZMEzFVSOArKhxr+EHNmT8oW4ll1JCrLKXI:8ZMEzfPhxSMmT8oWgBCaX
TLSH
T19B8502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 09ac2baa6b0fc71e22930cb9e0faeebc6ca0a2823d2d91b1d0e89b1603c8d6b7
MD5 78d3b6c6232b2537df882f4a99abb0da
SHA1 58449984e063b3f49f3146c8c8273454a7e93c05
SHA512 c9dae13284823c53200dc3ee066cb3ca520624c0506451d80308b1c3ac7a9222a34bbd877fe6935c676d14c92b839c3f7f1c97edd2c9a61c88409d93dd12d83a
SSDEEP 12288:xPJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T189652375AF0F649BED2A8339E8620715C9DC0DDDF242263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c9288357bb9edff47282ede31ed82cf88489a2e364f79e2215cd9d0d8d681602
MD5 e7960e5585965211a438d95ae4ad61ad
SHA1 4d7a00c88b79df73a347f8b1e1e4b3ef75cb155e
SHA512 434b808d8e68f301e3f746bce0c67875438d6613709db107f3e6b0285be3eb23ba839c53fa7ccb144d5e70fe0175241ac8ee8d861c5edbca7ec9c2e4f822cb2d
SSDEEP 12288:CzJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:CVrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C1652375AF0F54EBED2A8335E9620715D99C0DDDF202263BEF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 374e2cb0d2687666d451be9ea83fc4cf1fa83978d9e4f0ba71a34ffdf5a5d847
MD5 3ec2d0f5e3cd00b4b39a911d3f0f0897
SHA1 fa52a13dc364f15f0a24e8cea92c4f314792a433
SHA512 6be217a634169f7ab8f174d1e06ab73632f7f3c7c11494d58f36780f9c5bc40bf702d59a2642f56c83a07819ade7543dd02f81b3cd9c3e73620e1d4382b09945
SSDEEP 12288:4yPz5L8oJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ZzykrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10B751257779630F9D5378238C8620A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3804d689710a8efc1234c815757072fdf43edb46a0ed7c2bbafaf523103f1621
MD5 7995bd8ecda9a2df516e56a5b7694926
SHA1 6367e192f1fc732ea20e0b42b6aef61e0867e9fd
SHA512 68170eb9b171ff5fbf2fe9148328c7e752a54dd8f066aa8531b505ddc71e6fa87461afe83f571bbbdf2bf8675ba7cc5da0867eeb8c317a1b479e701c35c65ad4
SSDEEP 12288:hPJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:hxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T199652375AF0F649BED2A8339E8620715899C0DDDF242263BEF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b1bd168baa652266a478d5d5914f951151891fb8336d4a3cd67dfc44a6ec60b5
MD5 e41c2e11824c4148c97ae55e70ab94c8
SHA1 dc76163c07dc376fab2928d297815c9b2c7fb9f3
SHA512 9fecced3733e9875f6001d3cc18b114bac3ba4e8e00f4b780e2245b43278402cc2f9a1c010c168a9cdcc2838acd34165147aed6e44699a5a35217046e20ba0a0
SSDEEP 12288:APJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:AxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19E652375AF0F64EBED2A8335E862071599DC0DDDF242263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5e862c1f7c744e95fa129ea80e228fa751c07d6ce4e17ef9f2e524a37df72d88
MD5 88478a7f08657b6065d7dc4e2466f4fc
SHA1 7f70e5aafb29aeed4d0f6e8abb9056022ba8b870
SHA512 6140a7ca4cd9fcf1b9b8787d7bc11b5bebb0a952a04f042ff31a077ae9639054034aa5a8829b111d2868ba4fa0c55ed8eef709916e274876cd899d58d346b2d6
SSDEEP 12288:KyPz5L8oJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XzykrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DA751257779630F9D5378238C8621A02F7B57C7953208BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 fab417b8ace3d0004ceb481f3484a858244f74c82d71f9d0b409654c81e24c62
MD5 2f6e36a88e7ca1ac242864267116ebe4
SHA1 97babea39c08e48f663189669c0f1e1f1fd7c5ad
SHA512 3288787fb3a2b096b02f591929b4bb08f3e8908aacaa9a5f4dbc9f79629791ab0d70da1c29b02f0f9717c3db31f0883435fcd306564688911812016be40612a6
SSDEEP 24576:vTdaLl3z0zDOrKhxr+EHNmT8oW4ll1JCrLKXI:vTwLljehxSMmT8oWgBCaX
TLSH
T15E8502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 2d624f15f1a5a9e49e2b88eadd447284ebc41b53fd689de0cbda0d184ea13ce7
MD5 d95aa399c5a460e5f024dc19ed61d3e1
SHA1 ee673e386a2bb6b6dd679caf4f31bf7fac8ab293
SHA512 e06fc5388458ca54f0cc600ae1a883b0263bcee57fb01d329e68f4096bee9bc8eeb4b1b9b5a0e07b6ea77a954fd494685b4b7f05ec327b7293bad3892982b5d7
SSDEEP 24576:p35d9CHKy7GZarKhxr+EHNmT8oW4ll1JCrLKXI:55d9CHKyaPhxSMmT8oWgBCaX
TLSH
T1BC95CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7366e74c3578f6926917c27c6e4845531d05b6ac0aa92c07d28241755fb110e4
MD5 1890030a866d9b12765b384a08e525c1
SHA1 d2fa614acaa9186e15ebd9e0ec424a607613715b
SHA512 dea3a28f84c08bf53a117bfc1677a315dbf59e3963ee64379cb6f28a20e092c6991cf26b392c49f64eeaa255694703079b512ffa0e392ba513bef6e9cb6f6622
SSDEEP 12288:ReJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:R+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E6652375AF0F94DBED2A8335E8620316D9DC0DDDF2411A3BAF3E2E683B35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 517199b9acca227f646ff1b522cd0073f4ba8ea9479c9f51819250ee86312292
MD5 b73d6eb448eefe446eef2ef859e1f1ed
SHA1 4fd329d895544f58e44ca82ff1bd573e828fe0e0
SHA512 ef5264eaef3014eecb4271119cafd0d424226698b71f131973123773c07137e5d13532ece27102d8bb0787cda2ff89bc575c120ef4a1cc47375d56975e3395c3
SSDEEP 12288:qIJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:qErKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A7652375AF0F54EBED2AC335E862471299DC0DDDF1021A3BAF3E2E683B35C5A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 38dfb4784f4ff44d7949dd3eedf96bdb02f52b2b4bd80b04d369adcaf1dc0bbc
MD5 89a9b26ea90ecc87306a2c0f3e77430f
SHA1 b04bc09aa8ac43451dc9d7adeb6d84893aad6e4c
SHA512 37d4f364e6a314bc052098def3455c62ae656476836183fe7ba78e3c8b07ed0fc37b0714146d63b6e9aa5afd91ec5c5007baed3a3247b344b18f8c36e4a93475
SSDEEP 12288:iRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:inrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T117652375AF0F54ABED2A8339E8620715D9DC0DDDF242263BEF3E2E683B35C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 8fba40202f88d22efaf2df3dccff4c950a142e3f045046d5f2db726eaa6457c3
MD5 adf73d79d352091f3a82b9891c0639fc
SHA1 4d3649e3b709c08f1faeb389f3c220e983b0833c
SHA512 29fe4b11c90b50b521b776278df470577c7127002ee1b23e7a34d47f2542194415e03d33ed26b8c1abfb4a0610d14d2cb04144e6787a205e5e8942adb496c406
SSDEEP 12288:2PJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:2xrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T151652375AF0F54DBED2A8339E862071599DC0DDDF142263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6f5dc9b551631ef31369df53c560ef9e980f7e5387786beffd2b26af8920aa84
MD5 d32f7158e67d384bfa4c42a1e574d020
SHA1 11027b289f7596866ff7b30713ae4242e9364240
SHA512 42bfe07ce95053d4ba821351bc9b5bb5462459538af5817aa7f8802f02df8112fff3b28e847fab4404501ad7c30ad7d61f0e15861b8a9044cd1db8a041798574
SSDEEP 12288:9eJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:9+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T153652375AF0F94DBED2A8335E8620316D9DC0DDDF2012A3BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 82e22cad3f68605b3ed80d74f1c531466efca720fe18ded86be590cb5d6e05c2
MD5 7f6a72cae0860e8fe0b41f2530c6f0d0
SHA1 b611b42f9984d3a26e747b400bcc9969cf32ec1b
SHA512 69a2193e480075a0247777d3baab18de1406ca208d46a5e134e70705dea73006c7f5f9a19f6c643dfe8a41609a8043b01a42bb1b5e19e14537a2555e7a80c32c
SSDEEP 12288:N3JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:N5rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DB652375AF0F54EBED2AC335E862471289DC0DDDF142263BAF3E2E683B35C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 26fe9ca0bbe7e26e522a67f211b2d285f553ad7cf1415213e6017af105464820
MD5 fa6b67c6c2b790f400e0b5a456a4d38f
SHA1 d99c8c30a41bbc3458658a3a0c7fe249a9db87d3
SHA512 43be4af289a8ccd28994e37f40a9fcbb8a39536afd00132ed53cf3955c3c2753a58bd8fdab5cd1a2e873db9d58aaecb2e3310df6da6ca7e53a8bdd6d96d49662
SSDEEP 12288:RFJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:RbrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DD652375AF0F94ABED2AC335E8620716D9DC0DDDF241263BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d73b7963ce741e72ecb667033887e0eb6a5b7f53e7d74ff165272770992b3f25
MD5 a149b15425692306896c8017e078de2a
SHA1 c89e6af859090394112a6859fb360d761ab4e3e8
SHA512 bcdee64d70a5cc349c16aa8b68eb36764df282613a71cd3e5f2324e6a6958e7d7c9e76d4dcdd41a63fb32d91a2bc8c49926bb826bdb9cb67f20463baff0a875b
SSDEEP 24576:7fwv+k9RX6wkyAIlrKhxr+EHNmT8oW4ll1JCrLKXI:jMnYIshxSMmT8oWgBCaX
TLSH
T14795DF29EBDC44E5E177923C99B3460AF6B178691B31C6CF026A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b6ad5e4ddd2ad7669858f3e79ec3d4154ae69289cd47bcd99fa74c4dfbb07f61
MD5 12770b2fb8a549a877be1995003ffe89
SHA1 fcce2060b99d72835dadcba08bd15449e9f2b7e2
SHA512 a0f61f7e518b0d2c06359e076a29228654fcc859e31b4c42d39604a644b1c5049c95ba68712d535e06e6b6b951e6a4ae339adab6fed6a848897c9f67a8f9d07e
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VhxSMmT8oWgB3:hySzPN+M4FHX
TLSH
T1C6066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5a5d4a23387e842199f5f41c4f30df8ca324452268ef1bebba6732c583eca615
MD5 c5efe2351da7873001172a6206e236e1
SHA1 c1b0913f39c068d91be52d40a0b1f1b963eba9eb
SHA512 db3fd2466e4891a0e16808192778db553fa934805f50d3f0dffb708c8e646510903a5fc91a80d094109e47fe38b7ffed5aeebd72510ed41a778d7edfecb98eaf
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQrKhxr+EHNmT8oW4ll1JCrLKXI:x47JUQj1irIhCnDHUPfF/FhxSMmT8oWM
TLSH
T12265AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 4a71a968977a9a610a367b84207ca280b583fa475698881ca1e55f3c20663f90
MD5 f3518cf35453c2b3552e7447c5bde77c
SHA1 bbf89e9db30ccc3e8fcbff70c172a7f2b0a1a2a4
SHA512 e49fe65a587c9d6fad23b7cf0216fc87e48ca939051c1d89c0c1030d75e64d45675a34bfca213f444a684cc1b14a7cf768936288ca01139f39866535df3023b8
SSDEEP 12288:1zsffJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:shrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13A75F11AD24811E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A905DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 cec8afedd4091f248bf81513f696e3a2fc32d2e40417890b337287bde56cf384
MD5 4b50d20b943f3c38d30448430eb30e8c
SHA1 e080813e4cb33e6812aacf70d677e67a7b3a6e56
SHA512 817931a5f6f7cc678a4281b68fb0c9fdef827f7f1fdee968e3ee76a4146f6f9a6b7ac7cc662c13c31dbfde51a63b12199dc6e7fc3cc915237adf2ba7d4947931
SSDEEP 12288:+/UmPXuU3fJdotj186qv9MwK3BRMAKkz:+/UeeUPDof8nyl3BRMAxz
TLSH
T18D3507017626DB4FC6A940322E32D5CCAB707D41EE04AF0773C9873FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0b71bae65c2feb7f48eb70304eb9f77bef05a5e91a2d7562dfc9c5bf93e45827
MD5 c9e9af1ab4560739a8019737991a92bf
SHA1 5d4305075b2cb29b18fc69b9a02a3c03ec9779dc
SHA512 030fbd100a0713dfbdaf57e38c43edca1f26edf40f10743d9b1326b0c94fbd6d4143e7d8f28280150d5c9b58357bf4303089d7288aab8e7fe7e81ccb96aee117
SSDEEP 6144:Nu3B+le82YFOEXSNo0GjSfW6+c2H8QytMxkQytMxju+HDaMDKbRVF3KYZZDjDN:Nu3B+l1rX5JjIW5mLZZ5N
TLSH
T12755F7815136E78FD1BA6132072A5B4C7B64EC07B7096F27B3CA457AD82A701A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 72f8def7dbd3ab5537f502d3efd0c7e9070c7bb7122722a53741681ee3a93608
MD5 19e5ca62c75eefc251a0cba61255e2ae
SHA1 8fd1ee05fdf18380955f0d1ddb1d6ace42ac3483
SHA512 ff486337558c7dcbb97a4e2e7798d10d83bce63851e8d0c4accbf16001bc3448c2498f2fc0bfc34e555170eae8bfbe07989eeb6fe57c53082c96052539a70089
TLSH
T1EBC08C0665BF94190F2E8088A71A3F9898803320C3C1CB20B7123B86BF30C0A0F5BA1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp1427.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1427.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpF0DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF0DE.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 215b88060fee202f04104b2492519c61ebf7658f6134d1b03d62413e999e9610
MD5 1472c5df9d309c7a0177345ec5c6c94e
SHA1 d57b5e42d53186d7afc94ac9bc41ac6331dfe729
SHA512 4719777aa214b022985cceea85d0f64c78d15d9decf5bfe0c6d8f5cbee5d1e52050a541dd42c5f2287f2a9062856eaf1b855b892bf787fb9c0d99a2dfede4cb9
SSDEEP 12288:8O7HJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XprKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18E6523719B0EA89BFC3A8334E8674321655D2DACD30055FBEF2A2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f3f7f9a0bf0b2e4933b5f158370a1df7e73c94d7311dd92a5306dec9b5116423
MD5 1c852a2a7e47a0b863e025f912f3c4aa
SHA1 581972eb47002a369f36594dd942f5f00f39a561
SHA512 71230b3fb65b8851d088755d34379a212f9a56ae97a35dcb2a4a6b12d415d0f5a2c2a983cf514424b9ba0c28d5f69d8451191aa0608a56553a19dfccaffacbc1
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYfrKhxr+EHNmT8oW4ll1JCrLKXI:tgb4mBIBhGFjhxSMmT8oWgBCaX
TLSH
T177659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 98fd0b829269afa0dc4e523be81c8c139726cafa6b98c0b3bd7041eee329b645
MD5 d83ce93d9049870391e00d6d53b9215d
SHA1 ccb3165eca1399bf8e999abb4c2f6afd1355fa2b
SHA512 b248ed30926a1c677a246db640920a80cdb59ba7973533d2fdcdfd0f096564dc3dfa9ad4203858153b0dcf77ff6e1057a3c2b66e46d141afa50d9e8588c80f60
SSDEEP 24576:YG88u8FpJqH1hzria7/mArKhxr+EHNmT8oW4ll1JCrLKXI:b7ZFPqVoa7/mhxSMmT8oWgBCaX
TLSH
T1B395F16577E101F1D47BD138C9824663F6B2B8251360EBDF0BA88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3b35d119d82a9a8759f786cb6b80348ce3df4bad4cc24913f868891a0f1971e6
MD5 7134eefe13207bb8339e19de603abe3b
SHA1 758ffbf83f6858d4204585489a8bc8d469ff086d
SHA512 50910791388e9a577a707066607809781508221b18cbc60347c25d9b4437288626f0eaff3c048bd1e6143f2eed0dde7b5aa2c21baeb36244524339147ce140ad
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfhxSMmT8oWgBCaX:pG05lO43b0+M4FHX
TLSH
T189D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 68fca824952582cc93c748e76d9618c40d8d64871ae88a86191ad24bc7e3bed0
MD5 34e8dd4750104fb0a538a46e0386281c
SHA1 fe1f3777868c6d3f03ea7fed109dcbbae1f297cb
SHA512 177161a44fdab6d41db1cede4335cb748ffdf8a2e7f7b3e8c7ce9810a9e83caa7dfdab9865cb749a70cc082be8b0fcfa21495a4e10ef6ceae35b8bbb65659fb2
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnirKhxr+EHNmT8oW4ll1JCrLKXI:Ga5POZ3+Jt2pasx2+m3hxSMmT8oWgBC8
TLSH
T1EC65AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4dd168d9c7144626db3520985ac1e2033a74d337c2f996fc35cc026e4afb9cbe
MD5 ae047ffcaaa4890da28ae1ddc6ce4c91
SHA1 e8dfa90680c8999e21389c4759dc178cafb900da
SHA512 7c8663beadb4c7877cb0d1b0578377a9b106246fff7260ffd15d1c5e354a9e7989754a503d5f726b70fc0796736af6b51b0e2daf588fdd7c7b1e4c62a4fca27d
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fk4rKhxr+EHNmT8oW4ll1JCrLKXI:iNc/zEOVHFGhxSMmT8oWgBCaX
TLSH
T199858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 72c9794708494c0550003ffa748ce7fa194da3c80341428b03f865e716cc9b71
MD5 0a864657fbceedba30c8e845acd010f4
SHA1 1341425e1aae6d9a483a3d0937b36b0040eb134a
SHA512 c4c0680c60cabfa02d9bb0dc9084b6d78dd3d0f1211935828b8c3b87c9bbb29d3db9d91797bafcf16b9c95ad4f3fa33ab1923765de45bd08fb683f0c414c269b
SSDEEP 24576:g6DIQaKngL2jdshRTdG1YxITqvfPkbIcbjLm:g6DIQarSj8RoTCCW
TLSH
T13525126D63AA01F4D06BE13D96934505E5B2B6B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd1ce6bd0cf972994d5c7af42fdc41027494f8b4f6e5ad09258164e6efec0bd3
MD5 cc083983d5587d2a55e67f17e52ec3e9
SHA1 da48f395f21eaf65a5389b6ad82ea3d668aec451
SHA512 99658ed9263e31439e86895fc3514159c46203c5af8294bf83f36c3ab610caa3e51d5248746510c95983b31d667ccdd3c8f8b9f385b6c0cb13414f84b64916d9
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmWrKhxr+EHNmT8oW4ll1JCrLKXI:F8MwBtOm5hxSMmT8oWgBCaX
TLSH
T12755AF6EBAB845E4D1FEC674CD238512EA727861133293CB5390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e53067db1f71cecbd171f43a4eb89928532cf4f38ef7a6853f1e5a165ba55943
MD5 4f588ea66ebf006edce879f87abd4495
SHA1 dcc48cfb88e22edb08ff26a4212c1af41d09c215
SHA512 53767bb06e864e68b215bce3ad464cec622f19d46c1f9c9d8db90a75c501653b3acbcf2991684a4e8404bdcb82a5cfde2405a9c72485123da209802d5c83f190
SSDEEP 24576:RPUr+NQ8rKhxr+EHNmT8oW4ll1JCrLKXI:RJQPhxSMmT8oWgBCaX
TLSH
T1CD85F12F269D18E5E67AE13DC9828719F7717866131292DF02A1817E5F33DD8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7ec92a20f9202d0dad878edd3c5af5f51573fab7d3214e238fb6dd48750287d7
MD5 1d11a36927f172edb6aad4d273994855
SHA1 d26d59877376c96ec6a3ce44e5ecab50481f585d
SHA512 8a8c6428e3a7ab6ae51fc5d212a28e1724fb5bd09afaa6220493df968555f832fb3d095a81ee51cfb1a89e974305862f98093e3ec35ed6ba72a8309bc8c412f6
SSDEEP 24576:0D3FHshBIYQgAdrKhxr+EHNmT8oW4ll1JCrLKXI:0DVHeBIAAkhxSMmT8oWgBCaX
TLSH
T1AC95E17DEB5C04E4E57BC17CDA638A06E77138AD032266DB069481B91F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/904-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/904-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/904-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/904-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1228-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1228-472-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1228-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1228-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2020-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2020-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2020-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2020-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2020-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2984-9-0x0000000002FC0000-0x0000000003045000-memory.dmp

Download

memory/2984-69-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/2984-263-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/2984-16-0x0000000002FC0000-0x0000000003045000-memory.dmp

Download

memory/2984-0-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/2984-169-0x0000000003E50000-0x0000000003EB7000-memory.dmp

Download

memory/2984-15-0x0000000002CF0000-0x0000000002E39000-memory.dmp

Download

memory/2984-175-0x0000000003E50000-0x0000000003EB7000-memory.dmp

Download

memory/2984-1-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/2984-6-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/2984-7-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/3564-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3564-470-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3564-86-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3564-92-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3564-515-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3564-516-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3740-29-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3740-30-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3740-23-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3740-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4964-468-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4964-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5032-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5032-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5032-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5032-108-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5032-110-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5076-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5076-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5076-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5076-453-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5392-59-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5392-65-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5392-58-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5392-429-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5396-617-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/5396-612-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/5396-666-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5396-677-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5396-611-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5708-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5708-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5708-469-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5708-466-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5708-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5844-513-0x000001E4FFF00000-0x000001E4FFFF1000-memory.dmp

Download

memory/5844-685-0x000001E4FFF00000-0x000001E4FFFF1000-memory.dmp

Download

memory/6112-471-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/6112-123-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6112-116-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/6112-117-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download